SOC for Cybersecurity - Cybersecurity Risk Management Examination DC6: Significant security incidents of the preceding 12 months: nature, timing, extent and disposition

What does DC6 require?

For security incidents identified in the 12 months before the description's period end date that significantly impaired achievement of the cybersecurity objectives, disclose their nature, timing, and extent or effect with their disposition; considerations include whether an incident required public disclosure by law, had a material financial effect requiring disclosure, led to sanctions, or forced the entity out of material markets or lost it material contracts.